CVE-2020-6816: XSS
Impact
A mutation XSS affects users calling bleach.clean with all of:
the svg or math in the allowed/whitelisted tags an RCDATA tag (see below) in the allowed/whitelisted tags the keyword argument strip=False
Patches
Users are encouraged to upgrade to bleach v3.1.2 or greater.
Workarounds
modify bleach.clean calls to use strip=True, or not whitelist math or svg tags and one or more of the following tags:
script noscript style noframes xmp noembed iframe
A strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs) will also help mitigate the risk.
References
https://bugzilla.mozilla.org/showbug.cgi?id=1621692 https://cure53.de/fp170.pdf https://nvd.nist.gov/vuln/detail/CVE-2020-6816 https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach
Credits
Reported by Yaniv Nizry from the CxSCA AppSec group at Checkmarx
For more information
If you have any questions or comments about this advisory:
Open an issue at https://github.com/mozilla/bleach/issues Email us at security@mozilla.org
Other sources
In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/bleachto a version that resolves this vulnerability.Fixed in 3.1.2 - Upgrade
Upgrade
mozilla/bleachto a version that resolves this vulnerability.Fixed in 3.1.2 - Configuration
Modify bleach.clean calls to use strip=True.
Mozilla Bleach (bleach.clean) strip = True - Configuration
Do not whitelist the svg or math tags (i.e., remove them from the allowed/whitelisted tags) when calling bleach.clean with strip=False.
Mozilla Bleach (bleach.clean) allowed/whitelisted tags = Remove svg and/or math - Configuration
If you are calling bleach.clean with strip=False, avoid having both RCDATA and either svg or math tags whitelisted (remove svg/math from the allowed/whitelisted tags).
Mozilla Bleach (bleach.clean) strip = False - Compensating control
Apply a strong Content-Security-Policy (CSP) with script-src that does not include unsafe-inline or unsafe-eval (e.g., script-src without unsafe-inline and unsafe-eval) to help mitigate the risk.
Event History
Frequently Asked Questions
What is the severity of CVE-2020-6816?
CVE-2020-6816 is classified as a high severity vulnerability due to its impact on web application security through mutation XSS.
How do I fix CVE-2020-6816?
To fix CVE-2020-6816, you should upgrade the Mozilla Bleach library to version 3.1.2 or later.
What software is affected by CVE-2020-6816?
CVE-2020-6816 impacts Mozilla Bleach versions up to 3.1.2 and Fedora version 33.
What types of attacks can CVE-2020-6816 facilitate?
CVE-2020-6816 can facilitate mutation cross-site scripting (XSS) attacks if improperly handled.
Is CVE-2020-6816 applicable to all versions of Mozilla Bleach?
No, CVE-2020-6816 is specifically applicable to Mozilla Bleach versions lower than 3.1.2.